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ROUTER-LEVEL COMMUNITY STRUCTURE OF THE INTERNET 

AUTONOMOUS SYSTEMS 
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Abstract. The Internet is composed of routing devices connected between them and orga¬ 
nized into independent administrative entities: the Autonomous Systems. The existence of 
different types of Autonomous Systems (like large connectivity providers, Internet Service 
Providers or universities) together with geographical and economical constraints, turns the 
Internet into a complex modular and hierarchical network. This organization is reflected in 
many properties of the Internet topology, like its high degree of clustering and its robustness. 

In this work, we study the modular structure of the Internet router-level graph in order 
to assess to what extent the Autonomous Systems satisfy some of the known notions of 
community structure. We show that the modular structure of the Internet is much richer 
than what can be captured by the current community detection methods, which are severely 
affected by resolution limits and by the heterogeneity of the Autonomous Systems. Here we 
overcome this issue by using a multiresolution detection algorithm combined with a small 
sample of nodes. We also discuss recent work on community structure in the light of our 
results. 


1. Introduction 

The Internet is a complex network composed of routing devices (routers) which are organized 
into administrative entities, the Autonomous Systems (ASes). Each AS has its own routing 
policies and design criteria, which are based on technological, geographical and economical 
constraints and aim at maximizing the performance in terms of bandwidth, delay and resilience. 
ASes are nowadays identified with large carriers, ISPs, IXPs, CDNs, and universities, among 
others, and they are interconnected as the result of commercial agreements between them, 
either as peers or in provider-customer relationships. 

ASes can also be classified into core ASes (once called Tier-l’s), and peripheral ASes. The 
core ASes are typically the large carriers and some CDNs and are densely connected between 
them. Instead, most ISPs lay in the periphery and are connected to one or more core ASes. This 
core-periphery division provides the Internet with an interesting hierarchy. In fact, many large- 
scale properties as the resilience, scalability and small-worldness of the Internet arise largely 
as a consequence of its hierarchical structure and self-organization [g Eg. Understanding 
them might help developing better models of the Internet and improving its performance, by 
optimizing routing or reducing congestion, for example. 

In this work we approach the hierarchical structure of the Internet at the router level by 
trying to identify the ASes as communities of nodes. We explore different notions of community 
structure, and we shall see that: (a) The goodness of the communities is in some way related to 
the core-periphery hierarchy of the ASes; (b) Though most of the ASes satisfy some notion of 
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community, their largely variable sizes represent a hard problem for the community detection 
algorithms. We shall also propose a method for identifying ASes using samples of nodes. 

Our work falls into the study of Internet topology. Some of the main results on this area 
can be found in |32j . In particular, the study of community structure of the Internet at the 
Autonomous Systems level has been previously approached in [ini[Il[I71[37] and, to the best 
of our knowledge, the community structure at the router level has only been addressed in |21| 
in the context of traffic queuing analysis. For the community detection problem in general, we 
address the reader to the survey by Fortunate m- 

The paper is organized as follows: In the Dataset section we describe the Internet ex¬ 
ploration that we used; then, in Analysis methods and results we apply several community 
detection algorithms to it, matching the obtained communities to the ASes; we also introduce 
a multiresolution community detection algorithm based on modularity maximization and we 
determine which is the best resolution for each AS; in the Discussion section we evaluate the 
results and explain their variability: why some ASes satisfy our notion of community while 
others do not. Finally, in the Conclusions we extract the main results of this work. 

2. Dataset 

The dataset used throughout this paper was provided by CAIDA [7]. The CAIDA association 
performs daily explorations of the Internet by sending periodic IP packets (probes) towards 
random destinations from a set of sources called monitors (which nowadays count around 
100). These probes are sent with a traceroute tool which exploits the ICMP functionality: 
by means of the ICMP protocol, the intermediate routers in a datagram transmission can 
provide the source with some information on the traversed path. Using this information, the 
CAIDA infrastructure builds a map of the Internet at the router level. Several problems must 
be resolved through this process, such as IP aliasing (the association of several IP addresses 
with one same router) [26] and the existence of anonymous routers (routers which do not answer 
probes). Traceroute-based sampling is not a perfect sampling and has several biases |llj : some 
links are more frequently visited than others, and some links are probably not visited at all. 
This, together with the fact that the Internet is a fast evolving network, turns the map into a 
partial, approximate view of the Internet. 

However, router-level maps of the Internet have several applications, like improving routing 
algorithms by taking into account the network topology, understanding information propaga¬ 
tion, and studying the robustness and scale-free properties of networks 0131]. They can also 
be used for constructing maps of the Internet at the Autonomous Systems level 0133] . 

In this work we used the CAIDA router-level Internet map from October I9th, 2011 [2]. 
From the raw data we obtained an undirected graph consisting on 3, 248, 358 nodes (the routers) 
connected by 14,083,946 edges; 81.6% of the nodes also contain information about their Au¬ 
tonomous System (AS) affiliation (for a description on how this information was inferred, 
consult [33] and the CAIDA page [T]). The distributions for the degree and the clustering co¬ 
efficient are shown in Figure Figure shows the average clustering coefficient and neighbour 
degree distribution as a function of the node degree. 

2.1. Graph preprocessing. The graph contains some low-degree structures which make it 
difficult to analyse its community structure without some preprocessing. Regarding the AS 
affiliation, for example, the dataset contains 21,108 different ASes, of which 8,023 have less 
than 5 nodes, and 865 ASes contain 1 single node of degree 1. We also detected the pres¬ 
ence of many tendrils (sequences of degree-2 nodes finishing with a degree-1 node) involving 
1, 393, 846 nodes, which do not help to detect community structure. We removed these nodes 
by computing the 2-core of the graph [3] . 
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Figure 1. Node degree and clustering coefficient. In the left picture, the node 
degree distribution adjusted to a power law with a = 1.94 (max-likelihood 
estimation). In the right, a histogram of the clustering coefficient of the nodes 
(we omit nodes of degree 1 in the computation). 



Degree Degree 


Figure 2. Average clustering coefficient and average neighbour degree as a 
function of node degree. The left figure plots the clustering coefficient as a 
function of node degree (we omit nodes of degree 1 in the computation). On 
the right hgure, the average neighbour degree as a function of node degree. 


We also observed many sequences of degree-2 nodes finishing with higher degree nodes in 
their endpoints; we call these sequences chains. We found a negative correlation of —0.7 
between the events having degree-2 and not having AS affiliation, as shown in Tablein fact, 
88.9% of nodes without AS affiliation belong to chains, while 97.2% of the remaining nodes 
do contain AS affiliation. Some of the chains are due to the presence of MPLS tunnels na 
or other types of tunnels: 97.5% of nodes involved in chains and without AS affiliation have 
private IP addresses (i.e. their interfaces did not answer the traceroute probes). We could 
classify 64.7% of the chains as internal to the ASes, and 33.8% of them as inter-AS chains. 
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Table 1. Correlation between having degree 2 and having AS af¬ 
filiation. The table shows the joint distribution of the indicator variables 
degree2:having degree 2 and AS'.having AS affiliation. 


degree2 \ AS 

True 

False 

True 

0.12 

0.16 

False 

0.70 

0.02 


Thus, we decided to clear the graph by restricting the analysis to the 2-core and replacing all 
the chains by an edge between their endpoints. We found 531,625 chains of different types, as 
resumed in Table[^ The resulting graph after this process has 1,119,672 nodes and 11, 742,947 
edges. 99.2% of the nodes have AS affiliation now, and just 15, 288 different ASes are found. 

Table 2. Most common cases of chains of routers. Black and gray 
colours represent some hypothetical ASes; white nodes do not have AS affilia¬ 
tion. Many of these chains are caused by tunnels (like MPLS tunnels); others 
are probably due to a tie in the AS affiliation algorithm. After removing these 
chains, 99.2% of the nodes have AS affiliation. 


Chain 


Number of cases Typical configuration 


193398 

Internal AS connection 

90307 

Internal AS tunnel 

86775 

Inter-AS tunnel 

57988 

Inter-AS tunnel 

32473 

Internal AS tunnel 

28774 

Inter-AS tunnel 


3. Analysis methods and results 

We analysed the community structure of the Internet router-level graph by applying several 
community detection methods: 

• Infomap, by Rosvall and Bergstrom, based in the description length [38| . 

• LPM, the Label Propagation Method by Raghavan et al. [33], which performs a diffu¬ 
sion process on the graph. 

• Deltacom, an efficient greedy algorithm for modularity optimization introduced here. 

• Louvain, a fast modularity optimization algorithm [5|. 

• CommUGP, a local community detection method |4]. 

In the following subsection we shall introduce Deltacom, an algorithm for community de¬ 
tection based on modularity maximization. Later on, we shall evaluate the results using a 
similarity metric. 











ROUTER-LEVEL COMMUNITY STRUCTURE OF THE INTERNET AUTONOMOUS SYSTEMS 


5 


3.1. A multiresolution community extraction method. Deltacom is based on the op¬ 
timization of modularity. We recall that modularity was introduced by Newman in usmn] 
and, since then, several methods for its maximization have been proposed, like the one by 
Guimera et al. based on simulated annealing |20j . the extremal optimization method by Duch 
and Arenas the fast greedy algorithm by Blondel et al. [S] , or the multilevel algorithm by 
Noack and Rotta [50] . 

The following two results about modularity are fundamental to our present work: in m 
Fortunato and Barthelemy showed that modularity has a resolution limit, i.e., its maximiza¬ 
tion tends to put small communities together when they are connected among them; in |36| 
Reichardt and Bornholdt observed that modularity can be understood as the Hamiltonian of a 
ferromagnetic Potts model. Thus, maximizing the modularity implies finding the ground-state 
of this model, and the authors developed a simulated annealing based procedure for doing it. 

Deltacom considers the optimization of the modularity Q as a particular case of the opti¬ 
mization of a more general functional Qt, with a resolution parameter t, in which modularity 
corresponds to a normalized resolution, i.e., t = 1. The source of our idea can be traced back 
to the 7 resolution parameter in |36j . and has also been followed by Lancichinetti and Fortu¬ 
nato in m- In |36| . the maximization is based on simulated annealing, it must run at one 
single resolution each time, and its computational complexity is very high. The advantage of 
our method is that the resolution evolves dynamically, so that all the partitions at different 
resolutions can be produced during one single run, and with a low computational complexity. 

Deltacom is based on an agglomerative greedy algorithm; each step of the agglomerative 
process is a local maximum for Qt, i.e., the generalized modularity, at some particular resolution 
t. In other words, for each t-value a community partition is found, which is locally t-optimal 
in some sense. As these communities are joined, the resolution shrinks and t gets smaller. 
For t = 1, the structure is a local maximum for the classical modularity. In other words, we 
observe the graph as by using a magnifying glass, obtaining partitions at every resolution level. 
In particular, partitions at higher resolution levels are always refinements (in a mathematical 
sense) of those at lower ones. 

Here we present a brief description of how the algorithm works. Further mathematical 
details on the properties of Qt and of our maximization algorithm can be found in [6|. 


Newman’s modularity. Given a graph G = (V,E) and a partition of it, the modularity of 
the partition is defined as m- 


( 1 ) 



E 



kikj 

2m 




where m is the amount of edges, A = {Aij),i,j € H is the adjacency matrix of the graph, ki 
is the degree of the node i and S{i,j) is the indicator function that points out if nodes i and j 
belong to the same community in the partition 

The expression on the right side of Eq. compares the internal connections in the commu¬ 
nities (represented by the • S{i,j) product) with the expected number of connections under 
a random graph with the same expected degrees in the nodes and the same communities. It 
can be restated as a sum throughout the communities, in the following way: 


( 2 ) 


Q(^) 


^ y \ec-^ 

2m ^ [ 2m 


where kc is the sum of degrees of the nodes in each community C, and ec is twice the number 
of internal edges of it. 
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Now, in many agglomerative clustering methods, communities are joined by pairs at each 
step, until finding a local maximum. Joining two communities C and C during the process 
produces the following variation in the Q functional: 

where e(C', C") is twice the number of edges between C and C. 


Introducing a resolution parameter. We introduce a resolution parameter t as 

1 


(4) 






ec -1 


2m 


Now the functional variation after joining two communities C and C becomes: 


It is clear that a positive AQt value for a particular t also implies a positive (and even higher) 
AQt' for any resolution f < t. In other words, any agglomerative process which monotonically 
increases AQt also serves as a process monotonically increasing AQp for any t' < t. 

It is also immediate that a very large t value discourages any join, because AQt is negative 
for every pair of communities. It can also be shown that for t larger enough the global maximum 
for Qt would have each node isolated in its own community. 

Thus, what we propose is to start with a large enough t (so that the optimal initial partition 
has as many communities as nodes) and then to decrease t as little as possible so that a 
join can be made, i.e., so that some AQt becomes positive. This t value is just 


( 6 ) 




max 

C.C'G'^ 


e{C,C') ■ 2m \ 

kc • kc f 


When a local maximum is found for some t (i.e., no pair of communities can be joined 
without decreasing AQt), we decrease the resolution to t' such that AQt becomes positive 
for some pair of communities, following the previous formula. The agglomerative process 
continues until obtaining as many communities as connected components of the graph, and 
the obtained result is a set of locally optimal partitions for every resolution t, and such that 
the finer partitions are refinements of the coarser-grained ones. Even more, these partitions 
are what we call weakly optimal partitions, in the sense that not only the join of any pair of 
communities C, C would decrease Qt, but also any coarser partition (i.e. obtained by joining 
its communities in any way) would also decrease it. 

The code for the Deltacom algorithm is freely available at SourceForge |T2j; given a graph 
as a list of edges, it produces a set of community partitions for every resolution value. 

The formalization of the process is contained in Table For a complexity analysis, we 
shall consider keeping a set of lists Lc, one for each community, containing its neighbour 
communities C and the edge cut with each of them. The lists shall be ordered by a community 
identifier. The initial construction of these structures has time complexity 0(m ■ log{m)) (as 
each list has size sc, with and sq ■ log{sc) < m ■ log{m)). The while loop 

starting at line 1.6 has at most n cycles; each of these cycles has three steps: (a) finding a pair 
of communities with A(Qt) = 0; (b) joining the communities and; (c) decreasing t. The first 
step implies traversing all the lists; each A{Qt) computation is 0{1) so this step’s complexity 
can be bounded to 0{m). Joining two communities implies merging their lists into one, and 
also updating the lists of their neighbour communities. As all the lists are ordered, this can 
be done by traversing those lists, which we can bound to 0(m). Finally, decreasing t implies 
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traversing all the lists and computing for each element. This is again 0{m). Putting 

all together, we have at most n cycles with 0{m). The final complexity is then 0{nm). 

While 0{nm) is a theoretical upper bound for a general graph, the practical running time 
for sparse graphs can be greatly reduced with some considerations: step (c) gives all the 
information for the next step (a), because the community pair which maximized t' in line 
1.11 is the same that will have AQj = 0 in the next iteration; also, by keeping a search 
structure like an ordered tree with all the pair of connected communities C, C ordered by 
decreasingly, there is no need to traverse all the lists in each iteration, but we must 
just update the modified values into this tree and choose the community pair at its head as 
the one maximizing t'. For sparse graphs, this process has an upper complexity bound of 
0{'m ■ log(m) ■ where is the maximum number of neighbour communities that a 

community may have at any time of the process. 

Table 3. Pseudo-code for the multiresolution modularity optimiza¬ 
tion with Deltacom. This algorithm produces weakly optimal partitions 
for the generalized modularity Qt- In particular, is a weakly optimal par¬ 
tition for the classical modularity Q. The notation ^(a,6] represents that the 
partition is weakly optimal for every resolution in the (a, b] interval. 

Algorithm 1: Deltacom: Multiresolution modularity optimization 
Input: A graph G = {V, E) 

Output: A set of weakly optimal partitions for every resolution value 
fmin ^t< tmax, such that ^t' -< whenever i! <t 

1.1 begin 

Ql = {{ii},?; € V'\ #Initial partition 
fmax = maxc,c'es> I } #Initial t 

f — fmax 
‘lot = ^ 

while 1^1 > 1 do 

while there exists a pair [C, C) in ^ such that AQt(C', C") = 0 do 
^\{C,C'}U{CUC'} 

end 

if 1^1 > 1 then 

f = maxc.C'e® #Decreasing t 

^ #0iitput partition for the range {t 'is finished 

else 

t' = t #In the last step we Ccinnot decrease t 

= 3^ #Last partition; composed of one large community 

end 

t = f 

end 

^min =^^Minimum resolution; all the graph into one large community 
1.20 end 

3.2. Finding ASes through similarity maximization. We applied the five forementioned 
algorithms (Infomap, LPM, Deltacom at i = 1, Louvain and CommUGP) to the CAIDA 


1.2 

1.3 

1.4 

1.5 

1.6 

1.7 

1.8 
1.9 

1.10 

1.11 

1.12 

1.13 

1.14 

1.15 

1.16 

1.17 

1.18 
1.19 
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dataset. Each of these methods produces a partition ^ of the graph. In order to determine 
if the communities in these partitions are related to the ASes, we shall use this criterion: for 
each AS in the graph, and given a partition we find the community C S which maximizes 
the Jaccard similarity: 


J{C,AS) = 


|cn AS'l 
|CU AS'l 


This most similar community shall be called C^2s'- 


C^l = arg max J(C, AS') . 


And this maximum Jaccard similarity value will be called the recall score of the AS (ac¬ 
cording to [25]) and noted as i?i(AS): 

(7) Si(AS) = J(CW,AS) . 

In this way, we can evaluate each of the methods by observing the empirical cumulative 
distributions of the recall score of the ASes, i?i(AS) (Eq. [^. Those methods with left-skewed 
cumulative distributions (i.e., recall values closer to 1.00) tend to better reproduce the Au¬ 
tonomous System structure. The cumulative distributions for the different methods are part of 
Figure blue for Infomap, yellow for LPM, red for Deltacom, green for CommUGP and pink 
for Louvain. Small ASes with just a few nodes may introduce some noise into the comparison 
(firstly, because ASes with two or three nodes are not relevant for the analysis and secondly, 
because due to exploration biases sometimes their nodes are not even connected) so we also 
plot the cumulative distribution restricted to ASes of at least 100 nodes. 

We can clearly see that the five methods fail to reproduce the ASes structure. In the 
best performing one, Infomap, only 50% of the large ASes reach a recall of 0.4, which is 
however small. A premature conclusion might state that the Internet graph does not have 
communities at the router level, or at least that they are not related with the Autonomous 
Systems. But we will show that this is not the case, and that the failure of the methods is in 
part due to the largely variable sizes, internal structures and functions of the Internet ASes. 
However, the structure of the Internet graph at the router level can be better captured by 
using multiresolution methods. 

In order to assess our hypothesis we shall exploit the resolution parameter t of Deltacom, 
which provides us with a new level of freedom for matching the ASes in the community struc¬ 
ture. For each t value we have a partition Thus, in this case we define the most similar 
community for an Autonomous System, as: 

^AS —arg max (/(([7, A (S') , t € [^min 5 ^max] ; 

= arg max J{C\g,AS) , 

i e [i rnin 5^max] } 

and the recall score as: 

( 8 ) R2{AS) = J{cfsAS). 

In this way, the Jaccard similarity allows us to capture the moment in which each AS is 
formed. With this adjustments, the results clearly improve. The recall score R 2 AS) (Eq. 
over all the ASes is 0.87 (and 0.67 over the ASes of at least 100 nodes). The new cumula¬ 
tive distribution is presented as the black curve in Figure and we shall call it Deltacom 
Multiresolution^ as we are exploring all the communities at all possible resolutions. 

The observed improvements tell us that each Autonomous System has a natural resolution 
at which it can be best observed. There is an important correlation between this resolution and 
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Figure 3. Cumulative distribution of the AS recall score. (Upper) The curves 
represent the cumulative distribution of the recall scores over all the ASes for 
different community discovery methods: Ri{AS) is shown for Deltacom at t = 
1 (i.e., modularity maximization) (red), LPM (yellow), Louvain modularity 
maximization (pink), CommUGP (green) and Infomap (blue). If we we find 
the best resolution t for each AS using the Multiresolution Deltacom algorithm, 
we get the black curve, corresponding to i ?2 (AS). The brown curve represents 
the Multiresolution Deltacom using the resolution value t predicted by the 
regression line for each AS, and then computing Ri{AS) in Finally, if we 
use 15% of the AS routers when matching the partition at for each AS, 
then we get the light blue curve. (Lower) The same methods as in the upper 
picture, but restricted to ASes containing at least 100 nodes. 


the size of the AS, as the left picture in Figureshows. The right picture in Figure]^ shows 
the evolution of classical modularity Q for the Internet graph as a function of the resolution 
t, i.e. as the algorithm evolves (from right to left). As one of the properties of our algorithm, 
Qt has its maximum at t for every possible t, so that the classical Q is maximal at t = 1. 

3.3. Detecting ASes from samples. The previous results show us that different ASes have 
different resolutions, and that we cannot expect to get all the ASes with classical community 
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AS Resolution (log) 

Figure 4. Correlation between the AS size and resolution, and evolution of Q 
in Deltacom. The left figure plots the correlation between the AS size (in terms 
of the amount of routers) and the resolution at which it is best detected. The 
correlation coefficient between size and resolution in the log-scale is —0.93. A 
linear regression model between them gives the line y = 4.09 — O.GOa: shown in 
blue, with a determination of = 0.87. On the right figure, the evolution of 
classical modularity (Qi) as a function of t during the agglomerative process 
of Deltacom. 

detection methods or at some particular resolution value. However, our results with the mul¬ 
tiresolution method are ideal, in the sense that we used the information of the AS structure 
in order to know at which resolution to stop for each AS. Now we wonder whether we might 
retrieve the ASes using a minimal amount of information: their size, and a small sample of 
their nodes. We observed that there is a strong dependence between the AS size and the 
AS resolution, so that we shall use the linear regression in Figure]^ to approximate the best 
resolution for each AS, i. If we look for the most similar community to each AS restricted to 
the partition produced by Deltacom at that approximate resolution, then we obtain the 
brown curve in Figure 

Lastly, we shall consider that we only know 15% of the nodes at random. Suppose that 
AS sample C AS is the known subset for each AS. We shall estimate the most similar community 
using the ASsampie and the partition at resolution t: 

^AS arg max T((i7, , 

(9) R3{AS)=R2{AS) = J{cfs,AS), 

i.e., we only consider the nodes of the AS which are part of our sample when choosing the 
most similar community. Instead, for computing the recall score i ?3 {AS) (Eq. we consider 
all the nodes of the AS, so that the method can be compared against the others. The results 
for R 3 {AS) are those of the light blue curve in Figure 

The closeness between the brown and light blue curves proves that we do not need to 
know the whole AS in order to identify it as a community at a certain step of the modularity 
optimization process: 15% of the nodes is enough in order to get as good a result as if we knew 
all the AS nodes. However, the distance between the brown and black curve tells us that the 
linear regression between size and resolution is just a rough approximation. In conclusion, the 
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sample-based method seems to be very successful, and is only limited by the error of the linear 
regression. We can thus identify many of the ASes just knowing their size and a small sample 
of their nodes. 


4. Discussion 

The results in Figure show a type of stochastical dominance among the methods. The 
lowest curves are the ones most left-skewed and thus represent better correspondence between 
the communities identified by maximizing the Jaccard similarity and the ASes. In particular, 
the area above each curve is an interesting measure of the goodness of the method, and it also 
represents the mean recall score over all the ASes. The list of areas is presented in Table 
computed for the cumulative distributions of ASes with at least 100 nodes. 

Table 4. Average recall scores of the methods. Average recall score (or 
area above the cumulative distribution curve) for the different methods, over 
the ASes with at least 100 nodes. 


Method avg R{AS) 

LPM 005 

Deltacom (t=l) 0.08 

Louvain 0.13 

CommUGP 0.16 

Infomap 0.41 

Deltacom Multiresolution+Regression line+AS samples 0.58 

Deltacom Multiresolution-|-Regression line 0.59 

Deltacom Multiresolution (Best Resolution) 0.67 


The difficulties of classical modularity maximization due to the resolution limit and the 
degeneracy of its maxima are manifested in the poor average values obtained by Deltacom at 
t = 1 (0.08) and by Louvain (0.13) for the recall score of ASes with at least 100 nodes. But 
Deltacom Multiresolution has a good performance when we explore all the possible resolutions, 
showing that most of the Autonomous Systems do have a community structure (80% of them 
have a recall over 0.70). Instead, most of the ASes which were not detected by Deltacom 
Multiresolution belong to the core of the Internet: in Figurej^we plot a regression curve of the 
recall score on the AS rank. The AS rank is a ranking of ASes designed by CAIDA and based 
on the customer cone size (the set of ASes that an AS can reach using customer links [2H]L 
We observe that most of the ASes found with a low recall have a high AS rank and belong to 
large carriers. Regarding the scarce points with low AS Rank and low recall, we observed that 
some of them belong to IXPs and CDNs, which also belong to the Internet backbone but have 
a small customer cone. 

In Figures and 1^ we analyse some particular cases of (a) well-detected, high-ranked 
ASes, (b) bad-detected, high-ranked ASes and (c) very well-deteeted, mean-ranked ASes. Each 
row represents an AS, and the three columns represent (i) the internal node degree distribution 
(normalized by the node degree), (ii) the internal node degree vs. node degree and (Hi) the 
evolution of the best Jaccard similarity at different resolutions of the Multiresolution Deltacom 
algorithm (its maximum corresponds to the AS recall score). 

In the central pictures of Figure|^we plot the number of internal edges as a function of node 
degree for some ASes which were not well-detected. The diagonal dashed line corresponds to 
kin/k; the nodes under this line have more external connections than internal ones. The colour 
indicates if the node was classified inside the community which retrieved the best Jaccard 
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Figure 5. AS Rank vs. AS Recall score. Each point in this figure represents 
an Autonomous System, with the x-coordinate being its AS rank according to 
CAIDA [7] and its y-coordinate the recall score obtained with the Multires¬ 
olution Deltacom algorithm, i ?2 (AS') (Eq. . Only the ASes with at least 
100 nodes are represented here. Most of the low recall scores (less than 0.40) 
correspond to high-ranked ASes, which are usually Tier-l’s. The continuous 
curve was obtained with the LOESS local regressor, and the shadowed area 
represents the 95% confidence interval for the curve. 

similarity (black) or not (red). We observe that all the ASes in Figure have high degree 
nodes with more external that internal connections; these nodes are not recognized as part 
of their ASes and thus induce many of the short-degree nodes into error. Into these group of 
ASes we found carrier networks and IXCs (e.g., AT&T and Sprint), IXPs (e.g., the London 
Internet Exchange) and some CDNs (e.g., Akamai and Amazon). 

These types of ASes lay in the backbone of the Internet and they are densely connected 
among them, so that their nodes may not respect the classical notions of community. It 
is possible that we should think in an overlapping community structure for the core of the 
Internet, following the ideas in [40] regarding the core-periphery structure of networks and its 
relation with community structure. In this network, highly overlapping communities might 
be related with the presence of IXPs or nodes which do not satisfy the strong community 
definition, for example. 

ASes with good recall score are shown in FiguresandIn them, all the high-degree nodes 
have a high proportion of internal connections. These nodes usually act as hubs for their ASes; 
into this category we find medium-sized and large-sized ISPs, university networks and other 
small ASes. An example of one of these networks is the Google AS, shown in Figure In 
the lower part of the figure we plot the AS 15169 as detected by the Multiresolution Deltacom 
algorithm using the 15% of the nodes and the AS size; the recall score of the AS is 0.93. The 
colour of the nodes represents their eigenvector centrality inside the community with a light 
blue/blue/violet/red scale for increasing centrality values; the radius represents their degree 
in the full graph. The upper left picture shows the 15% sample in red, and the upper right 
figure shows the nodes in the frontier of the AS, also in red. Those nodes from the AS which 
were not detected by our algorithm are shown in white in the upper left picture. We observe 
an interesting modular structure, with several small modules strongly connected among them, 
and with a tree-like structure. Some high-degree nodes act as hubs inside the AS; however, 
they are not connected to other ASes usually. The AS has also a small connected component, 
probably due to a bias in the exploration or to the limitations of the AS affiliation algorithm; 
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this small component was not detected. However, the reconstruction of the main component 
was excellent; the only difference being some small degree nodes not belonging to the AS, 
but to carrier ASes like AT&T and Levels. Almost all the nodes in the frontier of the main 
component have small degree and small centrality values. The role of hubs is also visualized 
in Figure [l0| for the UCom Corporation AS. 

It is interesting to contrast the general results against some classical notions of community. 
Looking at the central pictures of Figures ilzl and again, we can see that all of them 
have nodes under the dashed diagonal line which represents the limit of the notion of strong 
community by Radicchi et al. [33], i.e., having more internal connections than external ones. 
This notion is quite strict indeed, and neither the real ASes nor the communities found by 
modularity maximization follow it. In [23] . Hu et al. introduced a relaxed version of this 
notion, in which each node has more internal connections than towards each of the other 
communities separately; we found that 4% of the nodes (spread through 70% of the ASes) do 
not follow this definition, either. 

Hric et al. |22j have recently used the Jaccard similarity for identifying communities with 
ground-truth groups as we did. They also observed that community detection algorithms 
perform very poorly according to this measure and they proposed some conjectures. One of 
these is the need to change the notion of community. Our work may shed some light into this 
question: in the Internet router-level graph, we show that the coexistence of communities with 
multiple resolutions is the main difficulty for the detection algorithms. So, when proposing 
new conceptions of community structure, we should take into account that very heterogeneous 
communities must coexist. 

Finally, we state that we exploited the multiresolution ability of our Deltacom algorithm 
for stopping at every possible resolution. It might be possible to apply this type of technique 
into other methods, in some way. For example, the CommUGP algorithm is a growing process 
which traverses the graph finding one community after another. It has a very strict cut criterion 
aimed at finding very cohesive structure; however, the Autonomous Systems might appear as 
consecutive nodes during the process. Regarding the Infomap algorithm, we observed that 
its performance was much better than that of classical modularity or LPM, but it does not 
overcome the resolution limit problem. In fact, Kawamoto and Rosvall [25] showed in a recent 
paper that the resolution limit also affects Infomap’s map equation, though it is less restrictive 
than in the modularity functional. 
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Figure 6. High-ranked ASes with bad recall score. Each row represents an 
AS. The left column plots the distribution of the internal node connections, 
kin, normalized by the node degree k. The vertical dashed line at kin/k = 0.5 
represents the notion of strong community. The central column plots the 
internal node degree, kin, vs. the node degree, k. The point size represents 
the number of nodes with that {kin,k) pair; the diagonal line represents the 
condition kin/k = 0.5. The node colour indicates if the node belongs to 
the most similar community retrieved by Multiresolution Deltacom (black) 
or not (red). The right column plots the best Jaccard similarity obtained 
with Multiresolution Deltacom at resolution t (its maximum being the recall). 
The horizontal dashed lines represent the recall score for Deltacom at t = 1 
(classical modularity) in red, for Infomap in blue and for Louvain in pink. 
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Figure 7. High-ranked ASes with good recall score. Normalized internal de¬ 
gree distribution (left-column), kin vs k (middle-column) and the best Jaccard 
similarity at resolution t (right-column) of the Multiresolution Deltacom algo¬ 
rithm for a set of 5 ASes with at least 100 nodes and high AS Rank, retrieved 
with a good recall score. A more detailed description can be found in Figurej^ 
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AS 3269 
Telecom Italia 
48532 nodes 
Recall= 0.86 
AS Rank=163 


kin/k 


AS 3352 

Telefonica Esp. 
6473 nodes 

Recall= 0.94 

AS Rank- 208 
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Figure 8. Average-ranked ASes with very good recall score. Normalized 
internal degree distribution (left-column), kin vs k (middle-column) and the 
best Jaccard similarity at resolution t (right-column) for a set of 5 ASes with 
at least 100 nodes and intermediate AS Rank, retrieved with a very good recall 
score. A more detailed description can be found in Figure]^ 
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Figure 9. The AS 15169 (Google). In the upper left picture, Google’s AS 
15169 with a sample of 15% of the nodes coloured in red. The gray nodes 
correspond to the community found by the Multiresolution Deltacom 

algorithm using that sample and the AS size. Lower, the detected community, 
C\g. In the upper right picture, all the AS with the frontier nodes coloured 
in red. The recall score for this AS is i ?3 = 0.93. (Image generated with 
Gephi) 
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Figure 10. The AS 17506 (Ucom Corporation, Japan). The structure of this 
Japanese AS with 4739 nodes is organized into different clusters. Many of these 
clusters have a redundancy structure formed by 4 routers, which is a typical 
configuration in many ASes. Though the clusters can be clearly distinguished, 
they also constitute one large community which the Multiresolution Deltacom 
algorithm retrieves with a recall score of i ?2 = 0.78. Some nodes play a special 
role into this cohesion by acting as hubs. We can identify them by computing 
the eigenvector centrality, which is shown as the colour of the nodes in a light 
blue/blue/violet/red scale: the red nodes have the highest centrality values, 
and they are the main hubs. The classical modularity optimization throws 
a recall of 0.19 instead, because the AS is already combined with others at 
t = 1. On the other hand, Infomap obtains a recall of 0.13. (Image generated 
with Gephi) 
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5. Conclusions 

We analysed the internal community structure of the Internet Autonomous Systems by us¬ 
ing Deltacom, a multiresolution algorithm. Deltacom performs community detection through 
modularity optimization at different resolution levels in one single run, and with a low compu¬ 
tational cost. The algorithm was made available to the scientific community as an open-source 
software through SourceForge. 

We applied Deltacom to the router-level graph of the Internet obtained from CAIDA, and 
we observed that most of the ASes which are not in the Internet backbone can be identified as 
communities if the proper resolution level is used in the community discovery process. However, 
we showed that classical modularity optimization failed to detect these Autonomous Systems 
due to the large variety of resolutions that they have. 

Many of the Autonomous Systems in the Internet backbone (and usually identified by a very 
high AS rank) could not be identified as communities, and we observed that this was due to the 
presence of high degree nodes with more external connections than internal ones, violating one 
of the main notions of community structure. Instead, stub ASes and ISP’s have high-degree 
nodes which act as hubs and provide internal connectivity, while the external connectivity is 
usually provided by lower-degree nodes. These ASes were well detected as communities. 

Finally, by correlating the resolution of each AS with its size and using a small fraction of 
the AS affiliation data, we showed that most of the ASes which do have a community structure 
can be retrieved. This provides a method for identifying Autonomous Systems with scarce 
information: a short sample of their nodes and their size. 

We think that these results on the Internet structure at the router level can be used for 
improving Internet topology models and the estimation of properties as node centrality or 
clustering, and shall also lead to new discussions regarding the hierarchical structure of the 
Internet. 
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